@@ -93,6 +93,16 @@ operations. It communicates with the Gofer process (via RPCs) to perform
 filesystem operations on its behalf. This increases security but comes with a
 performance trade-off.
 
+## Inode numbers
+
+Files on gofer mounts (the rootfs and bind mounts) report their host inode
+numbers. Host device numbers are mapped to sandbox-private device numbers, so
+files on different host filesystems under one mount report different `st_dev`
+values, as with Linux overlayfs. With `--inode-numbers=virtual`, the sandbox
+instead assigns sequential inode numbers and a single device number per mount,
+which costs memory for every file the sandbox has ever seen and a `stat(2)` call
+for every entry returned by `getdents(2)`.
+
 ## Shared root filesystem
 
 The root filesystem is where the image is extracted and is not generally
 
@@ -1695,7 +1695,9 @@ func (g *Getdents64Req) String() string {
 	return fmt.Sprintf("Getdents64Req{DirFD: %d, Count: %d}", g.DirFD, g.Count)
 }
 
-// Dirent64 is analogous to struct linux_dirent64.
+// Dirent64 is analogous to struct linux_dirent64. DevMinor and DevMajor are
+// the device numbers of the entry's file, or zero if the server does not
+// report them.
 type Dirent64 struct {
 	Ino      primitive.Uint64
 	DevMinor primitive.Uint32
 
@@ -703,6 +703,10 @@ func testGetdents(ctx context.Context, t *testing.T, tester Tester, root lisafs.
 		if uint64(dirent.Ino) != stat.Ino {
 			t.Errorf("dirent ino of %s is incorrect: want %d, got %d", dirent.Name, stat.Ino, dirent.Ino)
 		}
+		// Servers may omit device numbers.
+		if dirent.DevMinor == 0 && dirent.DevMajor == 0 {
+			continue
+		}
 		if uint32(dirent.DevMinor) != stat.DevMinor {
 			t.Errorf("dirent dev minor of %s is incorrect: want %d, got %d", dirent.Name, stat.DevMinor, dirent.DevMinor)
 		}
 
@@ -134,6 +134,11 @@ func (fs *filesystem) newDirectfsDentry(controlFD int) (*dentry, error) {
 	}
 	isDir := uint32(stat.Mode)&linux.FileTypeMask == linux.ModeDirectory
 	inoKey := inoKeyFromUnixStatx(&stat)
+	devMinor, err := fs.devMinorFromKey(inoKey)
+	if err != nil {
+		_ = unix.Close(controlFD)
+		return nil, err
+	}
 
 	// Common case. Performance hack which is used to allocate the dentry
 	// and its inode together in the heap. This will help reduce allocations and memory
@@ -160,6 +165,7 @@ func (fs *filesystem) newDirectfsDentry(controlFD int) (*dentry, error) {
 					fs:        fs,
 					inoKey:    inoKey,
 					ino:       fs.inoFromKey(inoKey),
+					devMinor:  devMinor,
 					rdevMajor: stat.Rdev_major,
 					rdevMinor: stat.Rdev_minor,
 					mode:      atomicbitops.FromUint32(uint32(stat.Mode)),
@@ -854,9 +860,12 @@ func (i *directfsInode) getDirentsLocked(recordDirent func(name string, key inoK
 	}
 
 	return fsutil.ForEachDirent(readFD, func(ino uint64, off int64, ftype uint8, name string, reclen uint16) {
-		// We also want the device ID, which annoyingly incurs an additional
-		// syscall per dirent.
-		// TODO(gvisor.dev/issue/6665): Get rid of per-dirent stat.
+		if !i.fs.opts.virtualInodeNumbers {
+			recordDirent(name, inoKey{ino: ino}, ftype)
+			return
+		}
+		// We also want the device ID, which incurs an additional syscall per
+		// dirent.
 		stat, err := fsutil.StatAt(i.controlFD, name)
 		if err != nil {
 			log.Warningf("Getdent64: skipping file %q with failed stat, err: %v", path.Join(genericDebugPathname(i.fs, d), name), err)
@@ -919,22 +928,8 @@ func (i *directfsInode) restoreFile(ctx context.Context, controlFD int, opts *vf
 		return fmt.Errorf("failed to stat %q in mount %q: %w", genericDebugPathname(i.fs, d), i.fs.iopts.UniqueID, err)
 	}
 	i.controlFD = controlFD
-	// We do not preserve inoKey across checkpoint/restore, so:
-	//
-	//	- We must assume that the host filesystem did not change in a way that
-	//		would invalidate dentries, since we can't revalidate dentries by
-	//		checking inoKey.
-	//
-	//	- We need to associate the new inoKey with the existing d.ino.
-	i.inoKey = inoKeyFromUnixStatx(&stat)
-	i.fs.inoMu.Lock()
-	i.fs.inoByKey[i.inoKey] = i.ino
-	i.fs.inoMu.Unlock()
-	// inodeByKey contains non-directory inodes only.
-	if !d.isDir() {
-		i.fs.inodeMu.Lock()
-		i.fs.inodeByKey[i.inoKey] = &i.inode
-		i.fs.inodeMu.Unlock()
+	if err := i.restoreInoKey(inoKeyFromUnixStatx(&stat)); err != nil {
+		return err
 	}
 
 	// Check metadata stability before updating metadata.
 
@@ -130,6 +130,7 @@ func (fs *filesystem) newSyntheticDentry(opts *createSyntheticOpts) *dentry {
 		inode: &inode{
 			fs:         fs,
 			ino:        fs.nextIno(),
+			devMinor:   fs.devMinor,
 			mode:       atomicbitops.FromUint32(uint32(opts.mode)),
 			uid:        atomicbitops.FromUint32(uint32(opts.kuid)),
 			gid:        atomicbitops.FromUint32(uint32(opts.kgid)),
 
@@ -31,6 +31,7 @@
 //	            dentry.handleMu
 //	              dentry.dataMu
 //	          filesystem.ancestryMu
+//	          filesystem.devMu
 //	          filesystem.inoMu
 //	          filesystem.inodeMu
 //	specialFileFD.mu
@@ -91,6 +92,7 @@ const (
 	moptDisableFileHandleSharing = "disable_file_handle_sharing"
 	moptDisableFifoOpen          = "disable_fifo_open"
 	moptCharDevicePolicy         = "char_device_policy"
+	moptVirtualInodeNumbers      = "virtual_inode_numbers"
 
 	// Directfs options.
 	moptDirectfs = "directfs"
@@ -211,7 +213,9 @@ type filesystem struct {
 	// clock is a realtime clock used to set timestamps in file operations.
 	clock ktime.Clock
 
-	// devMinor is the filesystem's minor device number. devMinor is immutable.
+	// devMinor is the filesystem's minor device number. It is used for
+	// synthetic files, and for all files if opts.virtualInodeNumbers.
+	// devMinor is immutable.
 	devMinor uint32
 
 	// root is the root dentry. root is immutable.
@@ -241,9 +245,18 @@ type filesystem struct {
 	syncableDentries dentryList
 	specialFileFDs   specialFDList
 
+	// devMinorByHostDev maps host device numbers, as encoded by unix.Mkdev,
+	// to minor device numbers assigned to files on those devices. It is only
+	// used if !opts.virtualInodeNumbers. Host device numbers may change
+	// across checkpoint/restore, so devMinorByHostDev is rebuilt on restore.
+	// devMinorByHostDev is protected by devMu.
+	devMu             sync.RWMutex `state:"nosave"`
+	devMinorByHostDev map[uint64]uint32
+
 	// inoByKey maps previously-observed device ID and host inode numbers to
-	// internal inode numbers assigned to those files. inoByKey is not preserved
-	// across checkpoint/restore because inode numbers may be reused between
+	// internal inode numbers assigned to those files. It is only used if
+	// opts.virtualInodeNumbers. inoByKey is not preserved across
+	// checkpoint/restore because inode numbers may be reused between
 	// different gofer processes, so inode numbers may be repeated for different
 	// files across checkpoint/restore. inoByKey is protected by inoMu.
 	inoMu    sync.Mutex        `state:"nosave"`
@@ -348,6 +361,12 @@ type filesystemOptions struct {
 	// via the gofer, or a combination of both.
 	charDevicePolicy charDevicePolicy
 
+	// If virtualInodeNumbers is true, files are assigned sequential inode
+	// numbers, recorded in filesystem.inoByKey, and the filesystem's device
+	// number. Otherwise files report their host inode numbers, and their host
+	// device numbers are mapped to sandbox-private device numbers.
+	virtualInodeNumbers bool
+
 	// directfs holds options for directfs mode.
 	directfs directfsOpts
 }
@@ -605,6 +624,10 @@ func (fstype FilesystemType) GetFilesystem(ctx context.Context, vfsObj *vfs.Virt
 		delete(mopts, moptDirectfs)
 		fsopts.directfs.enabled = true
 	}
+	if _, ok := mopts[moptVirtualInodeNumbers]; ok {
+		delete(mopts, moptVirtualInodeNumbers)
+		fsopts.virtualInodeNumbers = true
+	}
 	// fsopts.regularFilesUseSpecialFileFD can only be enabled by specifying
 	// "cache=none".
 
@@ -638,13 +661,14 @@ func (fstype FilesystemType) GetFilesystem(ctx context.Context, vfsObj *vfs.Virt
 		return nil, nil, err
 	}
 	fs := &filesystem{
-		mf:         mf,
-		opts:       fsopts,
-		iopts:      iopts,
-		clock:      ktime.RealtimeClockFromContext(ctx),
-		devMinor:   devMinor,
-		inoByKey:   make(map[inoKey]uint64),
-		inodeByKey: make(map[inoKey]*inode),
+		mf:                mf,
+		opts:              fsopts,
+		iopts:             iopts,
+		clock:             ktime.RealtimeClockFromContext(ctx),
+		devMinor:          devMinor,
+		inoByKey:          make(map[inoKey]uint64),
+		inodeByKey:        make(map[inoKey]*inode),
+		devMinorByHostDev: make(map[uint64]uint32),
 	}
 
 	// Did the user configure a global dentry cache?
@@ -828,7 +852,11 @@ func (fs *filesystem) Release(ctx context.Context) {
 		}
 	}
 
-	fs.vfsfs.VirtualFilesystem().PutAnonBlockDevMinor(fs.devMinor)
+	vfsObj := fs.vfsfs.VirtualFilesystem()
+	vfsObj.PutAnonBlockDevMinor(fs.devMinor)
+	for _, devMinor := range fs.devMinorByHostDev {
+		vfsObj.PutAnonBlockDevMinor(devMinor)
+	}
 }
 
 // releaseExtraRefsRecursiveLocked traverses the tree with root d and
@@ -914,7 +942,8 @@ type inode struct {
 	//   - Lock metadataMu and use atomic operations to update because we might
 	//     have atomic readers that don't hold the lock.
 	metadataMu sync.Mutex          `state:"nosave"`
-	ino        uint64              // immutable
+	ino        uint64              // immutable, except during restore
+	devMinor   uint32              // immutable, except during restore
 	mode       atomicbitops.Uint32 // type is immutable, perms are mutable
 	uid        atomicbitops.Uint32 // auth.KUID, but stored as raw uint32 for sync/atomic
 	gid        atomicbitops.Uint32 // auth.KGID, but ...
@@ -1251,7 +1280,12 @@ type dentryListElem struct {
 	dentryEntry
 }
 
+// inoFromKey returns the inode number of the file identified by key. With
+// virtual inode numbers, key must include the host device numbers.
 func (fs *filesystem) inoFromKey(key inoKey) uint64 {
+	if !fs.opts.virtualInodeNumbers {
+		return key.ino
+	}
 	fs.inoMu.Lock()
 	defer fs.inoMu.Unlock()
 
@@ -1263,6 +1297,111 @@ func (fs *filesystem) inoFromKey(key inoKey) uint64 {
 	return ino
 }
 
+// devMinorFromKey returns the minor device number of the file identified by
+// key.
+func (fs *filesystem) devMinorFromKey(key inoKey) (uint32, error) {
+	if fs.opts.virtualInodeNumbers {
+		return fs.devMinor, nil
+	}
+	dev := unix.Mkdev(key.devMajor, key.devMinor)
+	fs.devMu.RLock()
+	devMinor, ok := fs.devMinorByHostDev[dev]
+	fs.devMu.RUnlock()
+	if ok {
+		return devMinor, nil
+	}
+	fs.devMu.Lock()
+	defer fs.devMu.Unlock()
+	if devMinor, ok := fs.devMinorByHostDev[dev]; ok {
+		return devMinor, nil
+	}
+	return fs.newDevMinorLocked(dev)
+}
+
+// Preconditions: fs.devMu is locked.
+func (fs *filesystem) newDevMinorLocked(dev uint64) (uint32, error) {
+	devMinor, err := fs.vfsfs.VirtualFilesystem().GetAnonBlockDevMinor()
+	if err != nil {
+		return 0, err
+	}
+	fs.devMinorByHostDev[dev] = devMinor
+	return devMinor, nil
+}
+
+func hasDevMinor(devMinorByHostDev map[uint64]uint32, devMinor uint32) bool {
+	for _, m := range devMinorByHostDev {
+		if m == devMinor {
+			return true
+		}
+	}
+	return false
+}
+
+// restoreDevMinor returns the minor device number for the host device of key,
+// which identifies a restored inode that had minor device number saved at
+// checkpoint. saved is reused unless another host device has already been
+// mapped to it, so that device numbers are stable across checkpoint/restore
+// when the host filesystem is unchanged.
+func (fs *filesystem) restoreDevMinor(key inoKey, saved uint32) (uint32, error) {
+	dev := unix.Mkdev(key.devMajor, key.devMinor)
+	fs.devMu.Lock()
+	defer fs.devMu.Unlock()
+	if devMinor, ok := fs.devMinorByHostDev[dev]; ok {
+		return devMinor, nil
+	}
+	if hasDevMinor(fs.devMinorByHostDev, saved) {
+		return fs.newDevMinorLocked(dev)
+	}
+	fs.devMinorByHostDev[dev] = saved
+	return saved, nil
+}
+
+// releaseDevMinors releases the minor device numbers in prevDevMinors, the
+// devMinorByHostDev saved at checkpoint, that restore did not reuse.
+func (fs *filesystem) releaseDevMinors(prevDevMinors map[uint64]uint32) {
+	vfsObj := fs.vfsfs.VirtualFilesystem()
+	fs.devMu.Lock()
+	defer fs.devMu.Unlock()
+	for _, devMinor := range prevDevMinors {
+		if !hasDevMinor(fs.devMinorByHostDev, devMinor) {
+			vfsObj.PutAnonBlockDevMinor(devMinor)
+		}
+	}
+}
+
+// restoreInoKey records the host identity of a restored inode, and updates
+// the inode and device numbers derived from it. Host inode and device
+// numbers are not preserved across checkpoint/restore, so:
+//
+//   - We must assume that the host filesystem did not change in a way that
+//     would invalidate dentries, since we can't revalidate dentries by
+//     checking inoKey.
+//
+//   - With virtual inode numbers, the new inoKey is associated with the
+//     existing i.ino. Otherwise, i.ino follows the host inode number.
+func (i *inode) restoreInoKey(key inoKey) error {
+	i.inoKey = key
+	if i.fs.opts.virtualInodeNumbers {
+		i.fs.inoMu.Lock()
+		i.fs.inoByKey[key] = i.ino
+		i.fs.inoMu.Unlock()
+	} else {
+		i.ino = key.ino
+		devMinor, err := i.fs.restoreDevMinor(key, i.devMinor)
+		if err != nil {
+			return err
+		}
+		i.devMinor = devMinor
+	}
+	// inodeByKey contains non-directory inodes only.
+	if i.fileType() != linux.S_IFDIR {
+		i.fs.inodeMu.Lock()
+		i.fs.inodeByKey[key] = i
+		i.fs.inodeMu.Unlock()
+	}
+	return nil
+}
+
 func (fs *filesystem) nextIno() uint64 {
 	return fs.lastIno.Add(1)
 }
@@ -1346,7 +1485,7 @@ func (d *dentry) statTo(stat *linux.Statx) {
 	stat.Ctime = linux.NsecToStatxTimestamp(d.inode.ctime.Load())
 	stat.Mtime = linux.NsecToStatxTimestamp(d.inode.mtime.Load())
 	stat.DevMajor = linux.UNNAMED_MAJOR
-	stat.DevMinor = d.inode.fs.devMinor
+	stat.DevMinor = d.inode.devMinor
 	stat.RdevMajor = d.inode.rdevMajor
 	stat.RdevMinor = d.inode.rdevMinor
 }
 
@@ -32,6 +32,8 @@ func TestDestroyIdempotent(t *testing.T) {
 		inoByKey:   make(map[inoKey]uint64),
 		inodeByKey: make(map[inoKey]*inode),
 		clock:      ktime.RealtimeClockFromContext(ctx),
+		// There is no VFS to allocate device numbers from.
+		devMinorByHostDev: map[uint64]uint32{0: 1},
 		// Test relies on no dentry being held in the cache.
 		dentryCache: &dentryCache{maxCachedDentries: 0},
 		client:      &lisafs.Client{},
Original file line number	Diff line number	Diff line change
`@@ -703,6 +703,10 @@ func testGetdents(ctx context.Context, t *testing.T, tester Tester, root lisafs.`
`703`	`703`	`if uint64(dirent.Ino) != stat.Ino {`
`704`	`704`	`t.Errorf("dirent ino of %s is incorrect: want %d, got %d", dirent.Name, stat.Ino, dirent.Ino)`
`705`	`705`	`}`
	`706`	`+ // Servers may omit device numbers.`
	`707`	`+ if dirent.DevMinor == 0 && dirent.DevMajor == 0 {`
	`708`	`+ continue`
	`709`	`+ }`
`706`	`710`	`if uint32(dirent.DevMinor) != stat.DevMinor {`
`707`	`711`	`t.Errorf("dirent dev minor of %s is incorrect: want %d, got %d", dirent.Name, stat.DevMinor, dirent.DevMinor)`
`708`	`712`	`}`